Assets Discovery

POST /v1/domain/assets — enumerate URLs and applications seen on infected machines tied to a domain.

Maps a domain’s externally-relevant attack surface by listing every distinct URL found in credential records harvested from machines that had saved logins for that domain — internal tools, admin panels, VPN portals, SaaS apps, and more.

Request

POST /v1/domain/assets · Required scope: search:domain (all tiers) · Aggregation (counts toward agg_per_min) · Not paginated

Parameter	Type	Required	Default	Description
domains	string[]	Yes	—	Domains to enumerate, min 1 item
type	employees | users | both	No	both	See Overview
start_date	string (date-time) | null	No	—	Inclusive start filter, clamped by query_window_days
end_date	string (date-time) | null	No	—	Inclusive end filter
limit	integer	No	30	1–30 — this endpoint is capped lower than list endpoints

Example request

cURL

curl -X POST https://api.vantaprism.me/v1/domain/assets \
  -H "api-key: $VANTAPRISM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "domains": ["acme-corp.com"], "type": "employees", "limit": 30 }'

Response

200 OK — array of DomainAssetResult, ordered by occurrences descending. Not paginated — limit (max 30) bounds the result directly.

{
  "data": [
    {
      "url": "https://vpn.acme-corp.com/***",
      "domain": "acme-corp.com",
      "occurrences": 87,
      "unique_victims": 64,
      "employee_occurrences": 87,
      "user_occurrences": 0,
      "type": "employee",
      "last_seen": "2026-06-10T03:14:00Z"
    },
    {
      "url": "https://acme-corp.atlassian.net/***",
      "domain": "acme-corp.com",
      "occurrences": 53,
      "unique_victims": 41,
      "employee_occurrences": 50,
      "user_occurrences": 3,
      "type": "both",
      "last_seen": "2026-06-08T17:02:00Z"
    }
  ],
  "meta": {
    "request_id": "req_01HZXK3Q7N8YV6F3M2P9JABCDE",
    "took_ms": 64.7,
    "tier": "pro",
    "masked_fields": ["url"]
  }
}

Field	Description
url	Masked to scheme://host/*** on free tier via domain_only_url
domain	Registrable domain extracted from url
occurrences	Total times this URL was seen across all matching infections
unique_victims	Distinct infected machines that had this URL
employee_occurrences / user_occurrences	Breakdown by classification
type	employee | user | both
last_seen	Most recent infection date this URL was observed in

Errors

Status	code	Cause
400	VALIDATION_ERROR	domains empty, or limit > 30
403	FORBIDDEN_SCOPE	Key lacks search:domain
429	RATE_LIMIT_EXCEEDED	Exceeded agg_per_min

See Errors for the full catalog.

Tier notes

url is masked to scheme://host/*** on the free tier — the full path (which can reveal internal tool names/IDs) requires pro or ultra.